What is the __stripe_mid cookie?
__stripe_mid is an HTTP cookie set by Stripe, one of the most widely used online payment processing providers globally. It appears on a website as soon as Stripe.js or a Stripe payment element (checkout, card form, Payment Element) is loaded.
The cookie is generated automatically by Stripe's infrastructure, not by the site owner, and is used by Stripe regardless of the e-commerce platform or CMS the store runs on.
What data it stores
__stripe_mid stores a unique identifier generated by Stripe to recognize a device or browsing session across multiple visits. The value is an opaque alphanumeric string, generated and controlled exclusively by Stripe; its exact format is not publicly documented.
The data associated with this identifier is sent to Stripe's servers and used internally for risk analysis and fraud prevention during the payment process.
What it is used for
The main purpose of __stripe_mid is transaction security: Stripe uses it to correlate requests coming from the same device over time and detect suspicious behavior (for example, repeated payment attempts with different cards, automated activity, or patterns associated with fraud).
For the site owner, this cookie is essential to the correct functioning of the Stripe payment module – without it, Stripe's anti-fraud system cannot properly assess transaction risk, which can lead to legitimate payments being blocked or delayed.
Does it require consent?
- CookieFix category: necessary (strictly necessary).
- Consent: under Article 5 of the ePrivacy Directive (transposed in Romania via Law 506/2004) and ANSPDCP's interpretation, cookies strictly necessary for a service explicitly requested by the user (here, payment processing) do not require prior consent.
- Remaining obligation: the site owner must still list
__stripe_midin the cookie policy, stating its purpose and provider (Stripe), for GDPR transparency. - Note: if Stripe is used only for analytics or remarketing rather than actual payment processing, the classification may differ – check the exact setup.
How to block or delete __stripe_mid
A visitor can manually delete or block this cookie from browser settings (Chrome, Firefox, Edge, Safari – per-site cookie management). Blocking it may prevent the payment from completing or trigger additional security checks from Stripe.
For site owners, since this is a strictly necessary cookie, it should not be blocked via the consent banner, but it must be correctly disclosed. A CMP platform like CookieFix can automatically handle its classification and listing in the cookie policy, while blocking scripts from categories that actually require consent (statistics, marketing) until the user accepts.
Frequently asked questions
It's a strictly necessary cookie set by Stripe to identify a device or session for the purpose of preventing online payment fraud.
No, since it's strictly necessary for processing a payment requested by the user, it doesn't require prior consent under ePrivacy, but it must be disclosed in the cookie policy.
The Stripe payment form may not work correctly, or the transaction may be subject to additional security checks.
The typical duration is 1 year, though Stripe may adjust this value depending on context.